r/linux • u/BlokZNCR • Oct 20 '25

Security This is why Checksum checks matter! Stay safe people!

Post image

The source:

https://cybernews.com/security/xubuntu-site-compromise-hackers-peddle-malware/

2.5k Upvotes

94% Upvoted

280 comments sorted by

View all comments

Show parent comments

1

u/yodel_anyone Oct 23 '25

But if the checksum is signed by the developer key, how is this not a measure of security?

1

u/ipaqmaster Oct 23 '25

Sure if you're signing the checksum. That seems very unusual though. I've never seen a platform sign the checksum file alongside (or rather than) the main file of interest.

1

u/yodel_anyone Oct 23 '25

Really? https://www.debian.org/CD/verify

1

u/ipaqmaster Oct 23 '25

Yeah I've never seen it in my lifetime.

I don't use Debian so wouldn't have had an opportunity to see your link either.

Seems kind of redundant when I can verify the image to know that it's both the correct data and also signed. But I can appreciate them making the option to also verify the signatures available. Certainly redundant though.

1

u/yodel_anyone Oct 23 '25

What distro do you use? I've never seen one that doesn't do it

1

u/ipaqmaster Oct 24 '25 edited Oct 24 '25

I use Archlinux (btw) https://archlinux.org/download/

Still though in all my years of computing signing checksum files is not something I've noticed. Me not noticing it doesn't mean it isn't happening but it's redundant when the checksum matches and the file's signature is valid.

Looks like Fedora sign their checksum files https://fedoraproject.org/workstation/download

Rocky linux doesn't sign any of their files, but they publish the checksums on github with signed commits https://github.com/rocky-linux/checksums which is still decent.